CVE-2026-25750 LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl

Langchain Helm Charts are Helm charts for deploying Langchain applications on Kubernetes. Prior to langchain-ai/helm version 0.12.71, a URL parameter injection vulnerability existed in LangSmith Studio that could allow unauthorized access to user accounts through stolen authentication tokens. The...

Nuclio Shell Runtime Command Injection Leading to Privilege Escalation

Summary This vulnerability exists in Nuclio's Shell Runtime component, allowing attackers with function invocation permissions to inject malicious commands via HTTP request headers, execute arbitrary code with root privileges in function containers, steal ServiceAccount Tokens with cluster-admin...

Moderate: Red Hat Security Advisory: Red Hat Developer Hub 1.9.0 release.

Red Hat Developer Hub 1.9.0 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

SUSE CVE-2026-26056

Yoke is a Helm-inspired infrastructure-as-code IaC package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller ATC component of Yoke. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a...

Backup and Restore Operator 日志信息泄露漏洞

Backup and Restore Operator is an open-source Kubernetes application for backup and restoration. The Backup and Restore Operator has a vulnerability related to log information leakage, which stems from the S3 tokens being leaked into the logs of the rancher-backup-operator pod...

PT-2026-23091

Name of the Vulnerable Software and Affected Versions Nuclio versions prior to 1.15.20 Description Nuclio's Shell Runtime component contains a command injection issue. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into she...

PT-2026-23069

Name of the Vulnerable Software and Affected Versions Langchain Helm Charts versions prior to 0.12.71 Description Langchain Helm Charts, used for deploying Langchain applications on Kubernetes, had a flaw where a specially crafted link could lead to the theft of authentication tokens. This allowe...

Missing Encryption of Sensitive Data

Overview github.com/rancher/rancher/pkg/controllers/management/node is a complete container management platform Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data in the cluster creation using RKE templates with Weave CNI, where the WEAVEPASSWORD is not set,...

Rancher's weave CNI password is not configured when a cluster is created from an RKE template

Impact This vulnerability only affects customers using Weave CNI Container Network Interface when configured through RKE templates. A flaw was discovered in Rancher versions from 2.5.0 up to and including 2.5.13 and from 2.6.0 up to and including 2.6.4, where a UI user interface issue with RKE...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: zarf, kube-vip, cilium-cli, vertical-pod-autoscaler, crossplane-provider-aws-cloudfront, crossplane-provider-aws-iam, src, crossplane-provider-aws-kms, crossplane-provider-aws-cloudwatchlogs, external-dns, crossplane-provider-aws-dynamodb, pulumi-language-java,...

devops-security-pipeline-poc

DevOps Security Pipeline POC A security-integrated CI/CD pipe...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: temporal-server, kubevela-fips, kubescape-server-fips, azuredisk-csi, packer, syft-fips, gitlab-operator, kyverno-policy-reporter-plugins-kyverno-fips, keda-fips, zitadel, falcosidekick, azcopy-fips, conftest, tekton-pipelines-fips, verticadb-operator-fips,...

k8s-container-escape-lkm

🛠️ Kernel Module Reverse Shell – Privileged Container Escape P...

Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations

This report shows a scope-widening issue in the rotate re-encrypt flow: the output scope can be derived from untrusted spec.template.metadata.annotations on the input sealed secret. If a victim sealed secret is strict- or namespace-scoped, an attacker who can submit it to the rotate endpoint can...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: terraform-provider-azuread, zarf, crossplane-provider-family-azure, cilium-cli, src-fingerprint, crossplane-provider-aws-cloudfront, crossplane-provider-aws-iam, kots, boring-registry, crossplane-provider-aws-kms, crossplane-provider-aws-cloudwatchlogs, gitaly,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: terraform-provider-azuread, zarf, crossplane-provider-family-azure, cilium-cli, src-fingerprint, crossplane-provider-aws-cloudfront, crossplane-provider-aws-iam, kots, boring-registry, crossplane-provider-aws-kms, crossplane-provider-aws-cloudwatchlogs, gitaly,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation-fips, kubevela-fips, reports-server, kubescape-server-fips, argo-rollouts, sops-fips, crossplane-provider-aws-memorydb, omni-fips, crossplane-provider-aws-elasticache, extism, nuclei, packer, commercial-grafana,...

Important: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.0 release

Red Hat build of OpenTelemetry 3.9.0 has been released This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: The deprecated OpenCensus Receiver, which provided backward compatibility with the OpenCensus project for easier...

CLEANSTART-2026-VU62737 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the consul-k8s-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-KK99760 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the consul-k8s-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...